How to Generate Strong Passwords: The Complete Security Guide

What Makes a Password Strong?

A strong password is one that cannot be guessed or cracked in a practical timeframe. This depends on two core properties: length and character variety. Together, these properties determine a password's entropy — a measure of unpredictability expressed in bits.

The four character categories are:

• Lowercase letters (a–z): 26 characters
• Uppercase letters (A–Z): 26 characters
• Digits (0–9): 10 characters
• Symbols (!@#$%^&* and others): 32+ characters

When you use all four categories you draw from a pool of roughly 94 printable ASCII characters. A 16-character password from this pool has approximately 2¹⁰⁵ possible combinations — far beyond what any computer can search exhaustively.

Password strength is not just about theory. Attackers use real-world attack strategies including dictionary attacks (testing known words and phrases), credential stuffing (replaying leaked password lists), and rule-based attacks (applying common substitutions like @ for a or 3 for e). A password that looks clever to a human — P@ssw0rd! — is trivially cracked by modern tools because it follows well-known patterns.

The Most Common Password Mistakes

Despite decades of security advice, the same weak password choices appear in breach databases year after year. Understanding these patterns helps you avoid them.

1. Using Dictionary Words

Any word found in a dictionary — regardless of language — should be considered compromised. Cracking tools ship with wordlists containing millions of words, names, and common phrases. Adding a digit to the end (sunshine1) does not meaningfully increase security.

2. Keyboard Patterns

Sequences like qwerty, 123456, and zxcvbn are among the most common passwords found in every major data breach. Attackers test these first.

3. Personal Information

Using your name, birthday, pet's name, or favourite sports team creates a password that anyone who knows you — or can find you on social media — might guess. Even when combined with a year, these passwords are vulnerable to targeted attacks.

4. Short Passwords

An 8-character password using only lowercase letters has fewer than 209 billion combinations. A modern GPU can test that entire space in under 20 minutes. Every extra character multiplies the search space dramatically.

5. Predictable Substitutions

Replacing letters with look-alike symbols (p@ssw0rd, 5ecur1ty) is a common technique that attackers have accounted for with rule-based cracking. These substitutions add almost no real security.

Length vs. Complexity: Which Matters More?

Both matter, but length has the larger impact. Each additional character multiplies the total search space by the size of the character pool. Going from 12 to 16 characters (using a 94-character pool) increases the entropy by about 26 bits — meaning the search space grows by a factor of roughly 67 million.

Complexity (using multiple character types) grows the pool size. Moving from lowercase-only (26 chars) to all printable ASCII (94 chars) nearly doubles the entropy per character position. The combination of both — long and complex — is the gold standard.

The NIST SP 800-63B guidelines actually de-emphasise mandatory complexity rules (forcing uppercase + symbol) in favour of longer passwords, because complexity requirements tend to push users toward predictable patterns like Password1!.

Passphrases vs. Random Passwords

A passphrase is a sequence of random words used as a password. The concept was popularised by the "correct horse battery staple" xkcd comic and is mathematically sound. If you select four words at random from a 7,776-word list (the Diceware list), you get approximately 51 bits of entropy. Six words gives around 77 bits — comparable to a 13-character random password from a full ASCII pool.

Advantages of Passphrases

• Much easier to memorise for accounts where you must type your password
• Resistant to dictionary attacks if words are truly random (not a meaningful phrase)
• Comfortable to type on mobile devices

Advantages of Random Character Passwords

• Higher entropy per character position
• More resistant to targeted attacks when stored with weaker hashing
• Ideal when used with a password manager (no need to memorise)

For most people, the best strategy is a passphrase for the one or two passwords you must memorise (your password manager master password, for example), and randomly generated character passwords stored in a manager for everything else.

Why You Need a Password Manager

The fundamental problem with strong passwords is that they are hard to remember — and we have dozens of accounts. The solution is a password manager: a secure vault that stores all your passwords behind a single strong master password.

Password managers solve three problems simultaneously:

1. Generation: They create truly random, long passwords that humans couldn't come up with.
2. Storage: Passwords are encrypted at rest using AES-256 or similar algorithms.
3. Autofill: They only autofill on the correct domain, protecting against phishing sites.

Using a password manager means you only need to remember one strong master passphrase. Every other account gets a unique, randomly generated password that you never have to type manually.

Two-Factor Authentication

Even a perfectly strong password can be stolen through phishing, keyloggers, or server-side breaches where the hash is cracked. Two-factor authentication (2FA) adds a second layer of verification, typically something you have (your phone) in addition to something you know (your password).

The most secure forms of 2FA, in order:

1. Hardware security keys (FIDO2/WebAuthn) — phishing-resistant by design
2. TOTP authenticator apps (e.g., time-based one-time codes) — widely supported
3. Push notifications from a trusted app — convenient but vulnerable to MFA fatigue attacks
4. SMS codes — better than nothing, but vulnerable to SIM-swapping

Enable 2FA on every account that offers it, especially email, banking, and any account linked to payment information. Your email account is particularly critical — it can be used to reset passwords on all other accounts.

The Dangers of Reusing Passwords

Password reuse is arguably the most dangerous security habit. When one site is breached and passwords are leaked, attackers immediately try those same credentials on hundreds of other popular sites — a technique called credential stuffing.

The scale of breaches is enormous. Databases like Have I Been Pwned track billions of compromised credentials. If you use the same password on five sites and one of those sites is breached, all five accounts are now at risk — even if the other four sites have perfect security.

The OWASP Top 10 authentication guidance consistently lists broken authentication (including credential stuffing enabled by password reuse) as a critical risk category. The defence is simple: never use the same password twice.

NIST Password Guidelines Summary

The US National Institute of Standards and Technology publishes the authoritative framework for password security in NIST SP 800-63B. Key recommendations include:

• Minimum password length of 8 characters (12+ strongly recommended)
• Support for passwords up to at least 64 characters
• Check new passwords against lists of known compromised passwords
• Do not require periodic password changes unless there is evidence of compromise
• Do not impose complexity rules that reduce the password space in predictable ways
• Allow all printable ASCII characters, including spaces

Following NIST guidelines means focusing on length and randomness rather than arbitrary complexity tricks. A long, randomly generated password stored in a password manager is both the most secure and the most practical approach for everyday use.